jasmine/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Use local storage

Browse source
This commit is contained in:
♥ Minnie ♥ 2024-07-26 14:40:05 +08:00
parent 727400f4e9
commit a9b70d6e04
Signed by: jasmine
GPG key ID: 8563E358D4E8040E
6 changed files with 38 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nixos/common/global/age.nix
View file

@ -16,21 +16,13 @@ in
agenix-rekey
];
age = {
# Master identity used for decryption
rekey.masterIdentities = [ ../users/sajenim/agenix-rekey.pub ];
age.rekey = {
# Pubkey for rekeying
rekey.hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub;
hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub;
# Master identity used for decryption
masterIdentities = [ ../users/sajenim/agenix-rekey.pub ];
# Where we store the rekeyed secrets
rekey.cacheDir = "/var/tmp/agenix-rekey/\"$UID\"";
# All rekeyed secrets for each host will be collected in a derivation which copies them to the nix store when it is built
rekey.storageMode = "derivation";
storageMode = "local";
localStorageDir = ./. + "/secrets/rekeyed/${config.networking.hostName}";
};
# Required to persist `/var/tmp/agenix-rekey`
environment.persistence."/persist".directories = [
{ directory = "/var/tmp/agenix-rekey"; mode = "1777"; }
];
# As user not a trusted-users in our nix.conf
# we must add age.rekey.cacheDir as a global extra sandbox path
nix.settings.extra-sandbox-paths = [ "/var/tmp/agenix-rekey" ];
}